Wazuh Docker Deployment

Deploying Wazuh Docker in a Multi-Node Configuration

This deployment utilizes the multi-node/docker-compose.yml file, which defines a cluster setup with two Wazuh Manager, three Wazuh Indexer, and one Wazuh Dashboard containers. Follow these steps to deploy this configuration:

Increase vm.max_map_count on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions:
```
sudo sysctl -w vm.max_map_count=262144
```
Note: This change is temporary and will revert upon reboot. To make it permanent on each relevant host, you'll need to edit the /etc/sysctl.conf file, add vm.max_map_count=262144, and then apply the change with sudo sysctl -p.
Navigate to the multi-node directory within your repository:
```
cd multi-node
```

Download the certificate creation script and config.yml file:

curl -o wazuh-certs-tool.sh https://packages.wazuh.com/5.0/wazuh-certs-tool-5.0.0-1.sh
curl -o config.yml https://packages.wazuh.com/5.0/config-5.0.0-1.yml

Edit the config.yml file with the configuration of the Wazuh components to be deployed

nodes:
  # Wazuh indexer server nodes
  indexer:
    - name: wazuh1.indexer
      dns: "wazuh1.indexer"
    - name: wazuh2.indexer
      dns: "wazuh2.indexer"
    - name: wazuh3.indexer
      dns: "wazuh3.indexer"

  # Wazuh manager nodes
  # Use node_type only with more than one Wazuh manager
  manager:
    - name: wazuh.master
      dns: "wazuh.master"
      node_type: master
    - name: wazuh.worker
      dns: "wazuh.worker"
      node_type: worker

  # Wazuh dashboard node
  dashboard:
    - name: wazuh.dashboard
      dns: "wazuh.dashboard"

Run the certificate creation script:

sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv

Start the Wazuh environment using docker compose:
- To run in the foreground (logs will be displayed in your current terminal; press Ctrl+C to stop):
```
docker compose up
```
- To run in the background (detached mode, allowing the containers to run independently of your terminal):
```
docker compose up -d
```

Please allow some time for the environment to initialize, especially on the first run. A multi-node setup can take a few minutes (depending on your host resources and network) as the Wazuh Indexer cluster forms, and the necessary indexes and index patterns are generated.

2.7 KiB Raw Blame History

Wazuh Docker Deployment

Deploying Wazuh Docker in a Multi-Node Configuration

2.7 KiB

Raw Blame History